Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 3441–3460 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2025-51536

CVE-2025-51536

Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-04T15:22:04.875Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Aug 2025, 22:22 WIB

Official record

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2025-51726

CVE-2025-51726

CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicious actor to craft a fake installer with a forged SHA-1 certificate that may still be accepted by Windows signature verification mechanisms, particularly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-05T13:42:40.240Z.

CVSS

Showing 3441 to 3460 of 3629.First page Next page

—

KEVNot listed

EPSSPresent

Updated05 Aug 2025, 20:42 WIB

Official record

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2025-52239

CVE-2025-52239

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2026-07-05T16:08:14.904Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:08 WIB

Official record

HighPublished 04 Aug 2025, 07:00 WIB

CVE-2025-53394

CVE-2025-53394

Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and proceeds to mount it, Refl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-05T14:30:31.120Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:30 WIB

Official record

HighPublished 04 Aug 2025, 07:00 WIB

CVE-2025-53395

CVE-2025-53395

Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-05T14:29:34.000Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:29 WIB

Official record

MedPublished 04 Aug 2025, 07:00 WIB

CVE-2025-54554

CVE-2025-54554

tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-05T17:41:14.594Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated06 Aug 2025, 00:41 WIB

Official record

MedPublished 04 Aug 2025, 07:00 WIB

CVE-2025-54962

CVE-2025-54962

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-04T16:45:21.796Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated04 Aug 2025, 23:45 WIB

Official record

MedPublished 04 Aug 2025, 07:00 WIB

CVE-2025-55014

CVE-2025-55014

The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-11-04T21:12:59.566Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:12 WIB

Official record

MedPublished 03 Aug 2025, 21:32 WIB

CVE-2025-8513

Caixin News App com.caixin.news AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is required to approach this at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T14:32:05.191Z. Updated 2025-08-04T18:35:28.767Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 01:35 WIB

Official record

MedPublished 03 Aug 2025, 21:02 WIB

CVE-2025-8512

TVB Big Big Shop App hk.com.tvb.bigbigshop AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, has been found in TVB Big Big Shop App 2.9.0 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component hk.com.tvb.bigbigshop. The manipulation leads to improper export of android application components. An attack has to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T14:02:05.823Z. Updated 2025-08-04T18:37:38.290Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 01:37 WIB

Official record

MedPublished 03 Aug 2025, 20:32 WIB

CVE-2025-8511

Portabilis i-Diario Observações diario-de-observacoes cross site scripting

A vulnerability was found in Portabilis i-Diario 1.5.0. Impacted is an unknown function of the file /diario-de-observacoes/ of the component Observações. Performing a manipulation of the argument Descrição results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T13:32:05.211Z. Updated 2026-10-10T15:56:33.154Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Oct 2026, 22:56 WIB

Official record

MedPublished 03 Aug 2025, 20:02 WIB

CVE-2025-8510

Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T13:02:06.743Z. Updated 2025-08-04T18:59:22.406Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 01:59 WIB

Official record

MedPublished 03 Aug 2025, 19:32 WIB

CVE-2025-8509

Portabilis i-Educar educar_servidor_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T12:32:04.725Z. Updated 2025-08-04T16:51:23.266Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Aug 2025, 23:51 WIB

Official record

MedPublished 03 Aug 2025, 17:32 WIB

CVE-2025-8508

Portabilis i-Educar educar_avaliacao_desempenho_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be la…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T10:32:05.100Z. Updated 2025-08-04T17:23:35.814Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 00:23 WIB

Official record

UnscoredPublished 03 Aug 2025, 17:13 WIB

CVE-2024-51775

Apache Zeppelin: Command Injection via CSWSH

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T10:13:17.467Z. Updated 2025-11-04T21:09:01.910Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:09 WIB

Official record

UnscoredPublished 03 Aug 2025, 17:09 WIB

CVE-2024-41177

Apache Zeppelin: XSS in the Helium module

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T10:09:43.302Z. Updated 2025-11-04T21:08:43.404Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:08 WIB

Official record

MedPublished 03 Aug 2025, 17:02 WIB

CVE-2025-8507

Portabilis i-Educar educar_funcao_lst.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T10:02:05.615Z. Updated 2025-08-04T17:30:25.581Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 00:30 WIB

Official record

UnscoredPublished 03 Aug 2025, 17:02 WIB

CVE-2024-52279

Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string

Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T10:02:05.153Z. Updated 2025-11-04T21:09:03.247Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:09 WIB

Official record

MedPublished 03 Aug 2025, 16:02 WIB

CVE-2025-8506

495300897 wx-shop editUI cross site scripting

A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T09:02:04.908Z. Updated 2025-08-04T17:37:14.334Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 00:37 WIB

Official record

MedPublished 03 Aug 2025, 15:02 WIB

CVE-2025-8505

495300897 wx-shop cross-site request forgery

A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-03T08:02:05.563Z. Updated 2025-08-04T17:40:21.823Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 00:40 WIB

Official record